Active Directory CVE-2026-83648

Exploitation requires a valid low-privilege authenticated session against the targeted system (PR:L), and the affected component is the Active Directory Domain Services role, so the realistic target is a domain controller running AD DS reachable over the network. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the mandatory authentication requirement limits exploitation to attackers already possessing domain credentials (insiders or previously compromised accounts). Impact is confined to availability - the service crashes via null pointer dereference - with no confidentiality or integrity effect. Affected builds include Windows Server 2022/2025 and Windows 10/11 client versions below the fixed build numbers listed in the EUVD advisory; patched builds (e.g. Server 2025 >=10.0.26100.33650) are not exploitable.

This is a medium-severity, authenticated denial-of-service issue that should be treated as a routine patch-cycle item rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable, low-complexity attack requiring only low privileges, with impact limited exclusively to availability (C:N/I:N) - consistent with a null pointer dereference (CWE-476) that crashes the affected AD DS service rather than enabling code execution or data disclosure. All real-world exploitation signals point the same direction and reinforce a lower priority: CISA's SSVC decision framework reports Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing and no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one amplifying factor is the target's importance - Active Directory Domain Services runs on domain controllers, so a crash can disrupt authentication for an entire domain; however, the requirement for valid (low-privilege) domain credentials meaningfully limits the attacker population to insiders or already-compromised accounts. Net: a genuine but non-urgent availability risk, appropriate for standard patch SLAs for domain controllers.

An attacker who already holds low-privileged but valid domain credentials sends a specially crafted request over the network to a domain controller running AD DS, triggering a null pointer dereference that crashes the service. This can interrupt authentication and directory services for domain-joined systems until the service or host recovers. No public proof-of-concept or active exploitation has been identified at time of analysis.